Transacting Business Online - Legal Considerations

There are several categories of privacy and security issues facing those transacting business in today’s online environment.

Business owners have a responsibility to safeguard consumer and customer information from identity theft, and those who accept credit card payments must comply with the Payment Card Industry Data Security Standard (PCI DSS). If you intend to accept card payment, and store, process, and transmit cardholder data, you need to host your data securely with a PCI compliant hosting provider and meet other requirements intended to keep customer data secure.

If your online business sells products or services meant for children, you may need to be aware of the Children’s Online Privacy Protection Act (COPPA), which, among other things, prohibits you from collecting personal information from children under 13 years old. If your product or service is one which carries age restrictions by law, you may need to comply with additional rules and regulations for verifying the age of the purchaser online.

Gathering customer information on your site, including names, email, or postal addresses, or using cookies to track user activity online triggers the Federal Trade Commission (FTC) requirement that you post an online privacy policy on your site. The privacy policy should outline what information you will collect, how you collect it, how it will or will not be used, and how users can change this information. 

In addition to the online privacy policy, you may wish to post terms of use on your website. Although terms of use may not be legally required, they can help to limit your liability for errors in the content you post or link to on your site and for comments or content shared by third parties on your site. 

Your website terms of use should include things like restrictions on who may use the site and how site content can be used, and can also set out any other policies and procedures, including return policies, warranties, and choice of jurisdiction in the event disputes arise out of the use of the site. Requiring website users to accept these terms of use or privacy policies before using the site is your best protection against future claims.

Business owners who advertise or provide business opportunities via email also have to comply with email privacy rules. The CAN-SPAM Act requires that any email messages you send to customers or potential customers be clearly labeled as advertising, that there is a valid mailing address in the message, and that there is an easy way to unsubscribe to future messages. 

To protect your intellectual property, including your online advertising copy, product, and service descriptions, trade names, logos, and more, use the appropriate copyright or trademark symbols for registered works or for works you intend to register. Provide guidance for those wanting to display or re-use your intellectual property, such as how to request permission and under what conditions it can be used. Also, ensure that you are not infringing on others’ intellectual property rights by improperly using their content or trademarks. 

If you sell goods on the internet, you may have to collect sales tax just as you would in a brick and mortar store—at least in the states in where your business has a physical presence. Each state’s rules are different, and they may change at any time, so you should stay abreast of any changes.

Owners of businesses with an online presence may also want to purchase insurance to limit exposure for data and security breaches and/or to protect against infringement of intellectual property rights or other risks associated with your online business.

In addition to the legal requirements, rules, and regulations you must follow in operating your site and advertising online, you will want to carefully review any contracts or agreement you enter into with those who provide online services for your business, including those providing your website design and hosting, SEO optimization, and advertising services. Be sure that those service providers take steps to protect intellectual property, and have good online privacy and security policies and procedures in place as well.